Hello,
kernel test robot noticed "UBSAN:shift-out-of-bounds_in_kernel/trace/ftrace.c"
on:
commit: 0ae6b8ce200da00a78f33c055fdc4fe3225d22ec ("ftrace: Fix accounting of
subop hashes")
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git master
[test failed on linus/master 8ffd015db85fea3e15a77027fda6c02ced4d2444]
[test failed on linux-next/master b425262c07a6a643ebeed91046e161e20b944164]
in testcase: boot
config: x86_64-rhel-9.4-kunit
compiler: gcc-12
test machine: qemu-system-x86_64 -enable-kvm -cpu SandyBridge -smp 2 -m 16G
(please refer to attached dmesg/kmsg for entire log/backtrace)
+--------------------------------------------------------------------------------------+------------+------------+
|
| 04a80a34c2 | 0ae6b8ce20 |
+--------------------------------------------------------------------------------------+------------+------------+
| boot_successes
| 27 | 0 |
| boot_failures
| 0 | 30 |
| UBSAN:shift-out-of-bounds_in_kernel/trace/ftrace.c
| 0 | 30 |
|
Oops:general_protection_fault,probably_for_non-canonical_address#:#[##]SMP_KASAN_PTI
| 0 | 30 |
| KASAN:maybe_wild-memory-access_in_range[#-#]
| 0 | 30 |
| RIP:__ftrace_hash_move
| 0 | 30 |
| Kernel_panic-not_syncing:Fatal_exception
| 0 | 30 |
+--------------------------------------------------------------------------------------+------------+------------+
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <oliver.s...@intel.com>
| Closes: https://lore.kernel.org/oe-lkp/202504172247.26db367d-...@intel.com
[ 12.139798][ T1] ------------[ cut here ]------------
[ 12.140960][ T1] UBSAN: shift-out-of-bounds in
kernel/trace/ftrace.c:1426:11
[ 12.142488][ T1] shift exponent 51870560556424975 is too large for 32-bit
type 'int'
[ 12.143262][ T1] CPU: 1 UID: 0 PID: 1 Comm: swapper/0 Not tainted
6.15.0-rc1-00004-g0ae6b8ce200d #1 PREEMPT(voluntary)
[ 12.143266][ T1] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996),
BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[ 12.143266][ T1] Call Trace:
[ 12.143266][ T1] <TASK>
[ 12.143266][ T1] dump_stack_lvl
(kbuild/obj/consumer/x86_64-rhel-9.4-kunit/lib/dump_stack.c:123 (discriminator
1))
[ 12.143266][ T1] __ubsan_handle_shift_out_of_bounds
(kbuild/obj/consumer/x86_64-rhel-9.4-kunit/lib/ubsan.c:232
kbuild/obj/consumer/x86_64-rhel-9.4-kunit/lib/ubsan.c:492)
[ 12.143266][ T1] ? __pfx_mutex_unlock
(kbuild/obj/consumer/x86_64-rhel-9.4-kunit/kernel/locking/mutex.c:534)
[ 12.143266][ T1] __ftrace_hash_move.cold
(kbuild/obj/consumer/x86_64-rhel-9.4-kunit/kernel/trace/ftrace.c:1426
kbuild/obj/consumer/x86_64-rhel-9.4-kunit/kernel/trace/ftrace.c:1449)
[ 12.143266][ T1] ? kasan_save_track
(kbuild/obj/consumer/x86_64-rhel-9.4-kunit/arch/x86/include/asm/current.h:25
kbuild/obj/consumer/x86_64-rhel-9.4-kunit/mm/kasan/common.c:60
kbuild/obj/consumer/x86_64-rhel-9.4-kunit/mm/kasan/common.c:69)
[ 12.143266][ T1] ? mutex_unlock
(kbuild/obj/consumer/x86_64-rhel-9.4-kunit/include/linux/instrumented.h:96
kbuild/obj/consumer/x86_64-rhel-9.4-kunit/include/linux/atomic/atomic-instrumented.h:4479
kbuild/obj/consumer/x86_64-rhel-9.4-kunit/kernel/locking/mutex.c:166
kbuild/obj/consumer/x86_64-rhel-9.4-kunit/kernel/locking/mutex.c:536)
[ 12.143266][ T1] ? __kasan_kmalloc
(kbuild/obj/consumer/x86_64-rhel-9.4-kunit/mm/kasan/common.c:377
kbuild/obj/consumer/x86_64-rhel-9.4-kunit/mm/kasan/common.c:394)
[ 12.143266][ T1] ? alloc_and_copy_ftrace_hash
(kbuild/obj/consumer/x86_64-rhel-9.4-kunit/kernel/trace/ftrace.c:1198
kbuild/obj/consumer/x86_64-rhel-9.4-kunit/kernel/trace/ftrace.c:1377)
[ 12.143266][ T1] ? __pfx_mutex_unlock
(kbuild/obj/consumer/x86_64-rhel-9.4-kunit/kernel/locking/mutex.c:534)
[ 12.143266][ T1] __ftrace_hash_move_and_update_ops
(kbuild/obj/consumer/x86_64-rhel-9.4-kunit/kernel/trace/ftrace.c:1483
kbuild/obj/consumer/x86_64-rhel-9.4-kunit/kernel/trace/ftrace.c:3364)
[ 12.143266][ T1] ? __pfx_mutex_unlock
(kbuild/obj/consumer/x86_64-rhel-9.4-kunit/kernel/locking/mutex.c:534)
[ 12.143266][ T1] ftrace_update_ops
(kbuild/obj/consumer/x86_64-rhel-9.4-kunit/kernel/trace/ftrace.c:3387)
[ 12.143266][ T1] ? __pfx_mutex_unlock
(kbuild/obj/consumer/x86_64-rhel-9.4-kunit/kernel/locking/mutex.c:534)
[ 12.143266][ T1] ftrace_startup_subops
(kbuild/obj/consumer/x86_64-rhel-9.4-kunit/kernel/trace/ftrace.c:3566)
[ 12.143266][ T1] ? __SCT__fgraph_func (??:?)
[ 12.143266][ T1] ? __pfx_ftrace_startup_subops
(kbuild/obj/consumer/x86_64-rhel-9.4-kunit/kernel/trace/ftrace.c:3492)
[ 12.143266][ T1] ? __pfx_mutex_unlock
(kbuild/obj/consumer/x86_64-rhel-9.4-kunit/kernel/locking/mutex.c:534)
[ 12.143266][ T1] ? __pfx_store_entry
(kbuild/obj/consumer/x86_64-rhel-9.4-kunit/kernel/trace/trace_selftest.c:781)
[ 12.143266][ T1] register_ftrace_graph
(kbuild/obj/consumer/x86_64-rhel-9.4-kunit/kernel/trace/fgraph.c:1385)
[ 12.143266][ T1] ? ftrace_set_regex
(kbuild/obj/consumer/x86_64-rhel-9.4-kunit/kernel/trace/ftrace.c:6251)
[ 12.143266][ T1] ? __pfx_register_ftrace_graph
(kbuild/obj/consumer/x86_64-rhel-9.4-kunit/kernel/trace/fgraph.c:1322)
[ 12.143266][ T1] ? __pfx_ftrace_set_regex
(kbuild/obj/consumer/x86_64-rhel-9.4-kunit/kernel/trace/ftrace.c:6228)
[ 12.143266][ T1] test_graph_storage
(kbuild/obj/consumer/x86_64-rhel-9.4-kunit/kernel/trace/trace_selftest.c:966
kbuild/obj/consumer/x86_64-rhel-9.4-kunit/kernel/trace/trace_selftest.c:1014)
[ 12.143266][ T1] trace_selftest_startup_function_graph
(kbuild/obj/consumer/x86_64-rhel-9.4-kunit/kernel/trace/trace_selftest.c:1181)
[ 12.143266][ T1] ? __pfx_trace_selftest_startup_function_graph
(kbuild/obj/consumer/x86_64-rhel-9.4-kunit/kernel/trace/trace_selftest.c:1064)
[ 12.143266][ T1] ? __pfx_tracing_reset_online_cpus
(kbuild/obj/consumer/x86_64-rhel-9.4-kunit/kernel/trace/trace.c:2354)
[ 12.143266][ T1] ? mutex_lock
(kbuild/obj/consumer/x86_64-rhel-9.4-kunit/arch/x86/include/asm/atomic64_64.h:101
kbuild/obj/consumer/x86_64-rhel-9.4-kunit/include/linux/atomic/atomic-arch-fallback.h:4296
kbuild/obj/consumer/x86_64-rhel-9.4-kunit/include/linux/atomic/atomic-long.h:1482
kbuild/obj/consumer/x86_64-rhel-9.4-kunit/include/linux/atomic/atomic-instrumented.h:4458
kbuild/obj/consumer/x86_64-rhel-9.4-kunit/kernel/locking/mutex.c:156
kbuild/obj/consumer/x86_64-rhel-9.4-kunit/kernel/locking/mutex.c:276)
[ 12.143266][ T1] ? __pfx_mutex_lock
(kbuild/obj/consumer/x86_64-rhel-9.4-kunit/kernel/locking/mutex.c:273)
[ 12.143266][ T1] run_tracer_selftest
(kbuild/obj/consumer/x86_64-rhel-9.4-kunit/kernel/trace/trace.c:2152
(discriminator 1))
[ 12.143266][ T1] register_tracer
(kbuild/obj/consumer/x86_64-rhel-9.4-kunit/kernel/trace/trace.c:2190
kbuild/obj/consumer/x86_64-rhel-9.4-kunit/kernel/trace/trace.c:2306)
[ 12.143266][ T1] ? __pfx_init_graph_trace
(kbuild/obj/consumer/x86_64-rhel-9.4-kunit/kernel/trace/trace_functions_graph.c:1731)
[ 12.143266][ T1] do_one_initcall
(kbuild/obj/consumer/x86_64-rhel-9.4-kunit/init/main.c:1257)
[ 12.143266][ T1] ? __pfx_do_one_initcall
(kbuild/obj/consumer/x86_64-rhel-9.4-kunit/init/main.c:1248)
[ 12.143266][ T1] ? __pfx_parse_args
(kbuild/obj/consumer/x86_64-rhel-9.4-kunit/kernel/params.c:168)
[ 12.143266][ T1] ? __kmalloc_noprof
(kbuild/obj/consumer/x86_64-rhel-9.4-kunit/include/linux/kasan.h:260
kbuild/obj/consumer/x86_64-rhel-9.4-kunit/mm/slub.c:4331
kbuild/obj/consumer/x86_64-rhel-9.4-kunit/mm/slub.c:4343)
[ 12.143266][ T1] ? do_initcalls
(kbuild/obj/consumer/x86_64-rhel-9.4-kunit/include/linux/slab.h:909
kbuild/obj/consumer/x86_64-rhel-9.4-kunit/include/linux/slab.h:1039
kbuild/obj/consumer/x86_64-rhel-9.4-kunit/init/main.c:1328)
[ 12.143266][ T1] do_initcalls
(kbuild/obj/consumer/x86_64-rhel-9.4-kunit/init/main.c:1318
kbuild/obj/consumer/x86_64-rhel-9.4-kunit/init/main.c:1335)
[ 12.143266][ T1] kernel_init_freeable
(kbuild/obj/consumer/x86_64-rhel-9.4-kunit/init/main.c:1569)
[ 12.143266][ T1] ? __pfx_kernel_init
(kbuild/obj/consumer/x86_64-rhel-9.4-kunit/init/main.c:1449)
[ 12.143266][ T1] kernel_init
(kbuild/obj/consumer/x86_64-rhel-9.4-kunit/init/main.c:1459)
[ 12.143266][ T1] ? calculate_sigpending
(kbuild/obj/consumer/x86_64-rhel-9.4-kunit/kernel/signal.c:194)
[ 12.143266][ T1] ret_from_fork
(kbuild/obj/consumer/x86_64-rhel-9.4-kunit/arch/x86/kernel/process.c:159)
[ 12.143266][ T1] ? __pfx_kernel_init
(kbuild/obj/consumer/x86_64-rhel-9.4-kunit/init/main.c:1449)
[ 12.143266][ T1] ret_from_fork_asm
(kbuild/obj/consumer/x86_64-rhel-9.4-kunit/arch/x86/entry/entry_64.S:258)
[ 12.143266][ T1] </TASK>
[ 12.177300][ T1] ---[ end trace ]---
[ 12.177951][ T1] Oops: general protection fault, probably for
non-canonical address 0xeabbfbff80000000: 0000 [#1] SMP KASAN PTI
[ 12.178266][ T1] KASAN: maybe wild-memory-access in range
[0x55dffffc00000000-0x55dffffc00000007]
[ 12.178266][ T1] CPU: 1 UID: 0 PID: 1 Comm: swapper/0 Not tainted
6.15.0-rc1-00004-g0ae6b8ce200d #1 PREEMPT(voluntary)
[ 12.178266][ T1] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996),
BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[ 12.178266][ T1] RIP: 0010:__ftrace_hash_move
(kbuild/obj/consumer/x86_64-rhel-9.4-kunit/kernel/trace/ftrace.c:1429
kbuild/obj/consumer/x86_64-rhel-9.4-kunit/kernel/trace/ftrace.c:1449)
[ 12.178266][ T1] Code: 49 01 e9 49 89 c2 49 89 fc 48 8b 44 24 08 48 c1 e8 03
80 3c 28 00 0f 85 b8 05 00 00 49 8b 5f 08 4c 01 f3 48 89 d8 48 c1 e8 03 <80> 3c
28 00 0f 85 81 05 00 00 4c 8b 1b 4d 85 db 0f 84 90 01 00 00
All code
========
0: 49 01 e9 add %rbp,%r9
3: 49 89 c2 mov %rax,%r10
6: 49 89 fc mov %rdi,%r12
9: 48 8b 44 24 08 mov 0x8(%rsp),%rax
e: 48 c1 e8 03 shr $0x3,%rax
12: 80 3c 28 00 cmpb $0x0,(%rax,%rbp,1)
16: 0f 85 b8 05 00 00 jne 0x5d4
1c: 49 8b 5f 08 mov 0x8(%r15),%rbx
20: 4c 01 f3 add %r14,%rbx
23: 48 89 d8 mov %rbx,%rax
26: 48 c1 e8 03 shr $0x3,%rax
2a:* 80 3c 28 00 cmpb $0x0,(%rax,%rbp,1) <--
trapping instruction
2e: 0f 85 81 05 00 00 jne 0x5b5
34: 4c 8b 1b mov (%rbx),%r11
37: 4d 85 db test %r11,%r11
3a: 0f 84 90 01 00 00 je 0x1d0
Code starting with the faulting instruction
===========================================
0: 80 3c 28 00 cmpb $0x0,(%rax,%rbp,1)
4: 0f 85 81 05 00 00 jne 0x58b
a: 4c 8b 1b mov (%rbx),%r11
d: 4d 85 db test %r11,%r11
10: 0f 84 90 01 00 00 je 0x1a6
The kernel config and materials to reproduce are available at:
https://download.01.org/0day-ci/archive/20250417/202504172247.26db367d-...@intel.com
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
